web3 is going just great
LightNews LightNews
banner
web3isgoinggreat.com
web3 is going just great
@web3isgoinggreat.com
21K followers 1 following 770 posts
tracking only some of the many disasters happening in crypto, defi, NFTs, and other blockchain-based projects since 2021 • created by @molly.wiki

web3isgoinggreat.com
Posts Replies Media Videos
web3isgoinggreat.com
Binance's Trust Wallet extension hacked; users lose $7 million

December 25, 2025
https://www.web3isgoinggreat.com/?id=trust-wallet-hack
Binance's Trust Wallet extension hacked; users lose $7 million The Trust Wallet Chrome extension was compromised in an apparent supply chain attack. People who used the non-custodial wallet extension after it updated to version 2.68 lost funds after malicious code was introduced to exfiltrate wallet seed phrases so that the attackers could then drain the wallets. Victims have lost a combined $7 million due to the compromise. Binance founder Changpeng Zhao — who supposedly has no managerial role at Binance after he and the company were criminally charged in the US — announced that Binance would reimburse users who lost funds.
December 27, 2025 at 6:22 PM
web3isgoinggreat.com
Crypto trader loses $50 million to address poisoning attack

December 19, 2025
https://www.web3isgoinggreat.com/?id=0xcB8078-address-poisoning
Crypto trader loses $50 million to address poisoning attack A crypto trader lost almost $50 million in the Tether stablecoin after falling victim to an address poisoning attack. Because blockchain wallet addresses are long, random alphanumeric strings, traders often use the first and/or last several characters to quickly recognize wallets, and copy and paste regularly used wallet addresses from their transaction history. This has given rise to a type of scam known as "address poisoning", where scammers generate wallet addresses that share similar beginning and end characters, and use them to send transactions to wealthy victims. If they're lucky, as they were in this case, the victim will accidentally copy the similar looking scammer's wallet address when making a transfer of significant size. After the theft, the victim sent an on-chain message to the scammer, offering a $1 million "bounty" for the return of the remaining funds. They threatened, "We have officially filed a criminal case. With the assistance of law enforcement, cybersecurity agencies, and multiple blockchain protocols, we have already gathered substantial and actionable intelligence regarding your activities." However, there's been no activity from the wallet since the message, and the thief had long since begun laundering the funds via Tornado Cash.
December 23, 2025 at 8:07 PM
web3isgoinggreat.com
Yearn Finance suffers fourth exploit only weeks after third

December 16, 2025
https://www.web3isgoinggreat.com/?id=yearn-finance-exploit-4
Yearn Finance suffers fourth exploit only weeks after third Only weeks after losing $6.6 million to an infinite mint exploit, a Yearn Finance smart contract has again been exploited, allowing an attacker to make off with around 103 ETH (~$300,000). The affected contract is a legacy contract that was part of the Yearn v1 project (once known as iearn). The attacker used a flash loan to manipulate the price of tokens in the vault, allowing them to withdraw the iearn assets, which they then swapped for ETH. This is Yearn's fourth hack, following the $6.6 million theft in November, an $11 million exploit in 2023, and an $11 million exploit in 2021. Yearn also lost around $1.4 million in 2023 in connection to the Euler Finance attack.
December 17, 2025 at 2:12 AM
web3isgoinggreat.com
Ribbon Finance suffers $2.7 million exploit, plans to use "dormant" users' funds to repay active users

December 12, 2025
https://www.web3isgoinggreat.com/?id=ribbon-finance-exploit
Ribbon Finance suffers $2.7 million exploit, plans to use "dormant" users' funds to repay active users Ribbon Finance, which has partially rebranded to Aevo, has lost $2.7 million after attackers exploited a vulnerability in the smart contract for legacy Ribbon vaults that enabled them to manipulate oracle prices and withdraw a large amount of ETH and USDC. Ribbon has announced it will cover $400,000 of the lost funds with its own assets. However, Ribbon is also offering users a lower-than-expected haircut on their assets by assuming that some of the largest affected accounts will not withdraw their assets, having been dormant for several years. While this plan may benefit active users, it seems like it could get very messy if those dormant users do wish to withdraw their assets and discover they've been used to pay others.
December 15, 2025 at 7:32 PM
web3isgoinggreat.com
Prysm consensus client bug causes Ethereum validators to lose over $1 million

December 4, 2025
https://www.web3isgoinggreat.com/?id=prysm-bug
Prysm consensus client bug causes Ethereum validators to lose over $1 million Ethereum validators running the Prysm consensus client lost around 382 ETH ($1.18 million) after a bug resulted in delays that caused validators to miss blocks and attestations. Though the bug had been introduced around a month prior, it did not affect validators until Ethereum completed its "Fusaka" network update on December 3. Around 19% of Ethereum validators use the Prysm consensus client, which is developed by Offchain Labs.
December 14, 2025 at 5:53 PM
web3isgoinggreat.com
Binance employee suspended after launching a token and promoting it with company accounts

December 8, 2025
https://www.web3isgoinggreat.com/?id=binance-employee-suspended
Binance employee suspended after launching a token and promoting it with company accounts Binance has announced that the company has suspended an employee who used the platform's official Twitter accounts to promote a memecoin they had launched. The token, called "year of the yellow fruit", pumped in price after official Binance accounts coaxed followers to "harvest abundantly". Binance publicly acknowledged that an employee had been suspended for misconduct over the incident. "These actions constitute abuse of their position for personal gain and violate our policies and code of professional conduct," Binance tweeted from its BinanceFutures account. After this announcement, the memecoin token price spiked even further. Earlier this year, Binance fired another employee after discovering they had used inside information to profit from a token sale event.
December 8, 2025 at 7:43 PM
web3isgoinggreat.com
Aerodrome and Velodrome suffer website takeovers, again

November 22, 2025
https://www.web3isgoinggreat.com/?id=aerodrome-and-velodrome-website-takeovers
Aerodrome and Velodrome suffer website takeovers, again Attackers redirected users intending to visit the websites for the decentralized exchanges Aerodrome and Velodrome to their own fraudulent versions using DNS hijacking, after taking control of the websites' domains. The platforms urged users not to visit the websites as they worked to regain control. This is the second time such an attack has happened to these same platforms, with another DNS hijacking incident occurring almost exactly two years ago. In that instance, users lost around $100,000 when submitting transactions via the scam websites.
November 23, 2025 at 8:40 PM
web3isgoinggreat.com
Cardano founder calls the FBI on a user who says his AI mistake caused a chainsplit

November 21, 2025
https://www.web3isgoinggreat.com/?id=cardano-founder-calls-the-fbi
Cardano founder calls the FBI on a user who says his AI mistake caused a chainsplit On November 21, the Cardano blockchain suffered a major chainsplit after someone created a transaction that exploited an old bug in Cardano node software, causing the chain to split. The person who submitted the transaction fessed up on Twitter, writing, "It started off as a 'let's see if I can reproduce the bad transaction' personal challenge and then I was dumb enough to rely on AI's instructions on how to block all traffic in/out of my Linux server without properly testing it on testnet first, and then watched in horror as the last block time on explorers froze." Charles Hoskinson, the founder of Cardano, responded with a tweet boasting about how quickly the chain recovered from the catastrophic split, then accused the person of acting maliciously. "It was absolutely personal", Hoskinson wrote, adding that the person's public version of events was merely him "trying to walk it back because he knows Hoskinson's decision to involve the FBI horrified some onlookers, including one other engineer at the company who publicly quit after the incident. They wrote, "I've fucked up pen testing in a major way once. I've seen my colleagues do the same. I didn't realize there was a risk of getting raided by the authorities because of that + saying mean things on the Internet."
November 23, 2025 at 8:15 PM
web3isgoinggreat.com
Crypto tracking platform DappRadar shuts down, citing financial woes

November 17, 2025
https://www.web3isgoinggreat.com/?id=dappradar-shuts-down
Crypto tracking platform DappRadar shuts down, citing financial woes Amid a month of falling crypto prices, the crypto tracking platform DappRadar has announced it will be shutting down after seven years of operation. "Running a platform of this scale became financially unsustainable in the current environment," the company announced on Twitter. The company had previously raised several rounds of financing, with a $2.3 million seed round in 2019 and a $5 million Series A in 2021.
November 18, 2025 at 7:12 PM
web3isgoinggreat.com
Elixir shuts down deUSD after Stream Finance halt

November 6, 2025
https://www.web3isgoinggreat.com/?id=elixir-shuts-down-deusd
Elixir shuts down deUSD after Stream Finance halt After the defi yield platform Stream Finance announced a $93 million loss, Elixir announced it would be discontinuing its deUSD synthetic stablecoin. Stream Finance owes $68 million to Elixir, and holds around $75 million deUSD. Elixir has announced that they plan to allow deUSD holders to redeem their tokens for USDC through a process that will also eliminate the risk of Stream Finance cashing out their deUSD without repaying their loan. According to Elixir, "Stream comprised of 99%+ of the lending positions (and has decided to not repay or close positions)".
November 7, 2025 at 3:31 PM
web3isgoinggreat.com
Moonwell accrues almost $3.7 million of bad debt after oracle malfunction

November 4, 2025
https://www.web3isgoinggreat.com/?id=moonwell-oracle-malfunction
Moonwell accrues almost $3.7 million of bad debt after oracle malfunction The Moonwell lending protocol, built on the Base Ethereum L2, wound up with $3.7 million in bad debt after an attacker took advantage of an oracle malfunction that caused the price of wrsETH to be massively inflated. The Chainlink oracle used by the project erroneously reported that a single wrsETH token (Kelp DAO's wrapped restaked ETH) was priced at around 1.65 million ETH (~$5.8 billion). Within 30 seconds of the oracle reporting bad data, an attacker took advantage of the error to borrow huge amounts of tokens, which they then swapped to other tokens to cash out. Ultimately the attacker profited around 295 ETH (~$1 million), but the protocol was saddled with significantly more bad debt that the team will now have to grapple with.
November 7, 2025 at 3:12 PM
web3isgoinggreat.com
Stream Finance halts activity after $93 million loss

November 4, 2025
https://www.web3isgoinggreat.com/?id=stream-finance-loss
Stream Finance halts activity after $93 million loss The Stream Finance defi yield project announced that "an external fund manager overseeing Stream funds disclosed the loss of approximately $93 million in Stream fund assets." Stream announced that they were in the process of withdrawing remaining liquid assets, and had halted all deposits or withdrawals. They also announced they had retained a law firm to investigate the "incident". The project didn't disclose who the fund manager was, or the circumstances in which the "loss" occurred. The Staked Stream USD token depegged on November 3, and crashed further following the announcement.
November 4, 2025 at 3:43 PM
web3isgoinggreat.com
Garden hacked for $11 million

October 30, 2025
https://www.web3isgoinggreat.com/?id=garden-hacked-for-11-million
Garden hacked for $11 million The Garden bitcoin bridge suffered a roughly $11 million loss after one of its solvers was compromised. These solvers essentially act as market makers for the protocol. Some blockchain sleuths have questioned whether the affected solver, which Garden described as a separate entity, may actually be operated by the same team as Garden. There wasn't much sympathy to be had for Garden after this exploit. The protocol had recently announced hitting a milestone of bridging more than $2 billion in assets, but the celebration was criticized after zachxbt pointed out that a substantial portion of the bridged funds were proceeds of crimes being laundered to evade detection and recovery.
November 3, 2025 at 6:28 PM
web3isgoinggreat.com
Balancer exploited for at least $110 million

November 3, 2025
https://www.web3isgoinggreat.com/?id=balancer-exploit-2
Balancer exploited for at least $110 million The defi protocol Balancer suffered a major exploit that drained over $110 million across several blockchains, including Ethereum, Polygon, Base, and Sonic. Attackers exploited faulty access control in the manageUserBalance function of Balancer's v2 smart contract, enabling unauthorized internal withdrawals. The stolen tokens included 6,850 osETH, 6,590 wETH, and 4,260 wstETH, later consolidated into new wallets likely for laundering. The exploit also impacted forked protocols like Beets Finance, which lost around $3 million. Balancer's BAL token dropped over 10% following the theft. This was Balancer's third major security incident since 2020, despite prior audits by OpenZeppelin and Trail of Bits.
November 3, 2025 at 3:29 PM
web3isgoinggreat.com
Cryptomus fined $127 million for compliance failures

October 22, 2025
https://www.web3isgoinggreat.com/?id=cryptomus-fine
Cryptomus fined $127 million for compliance failures The Canadian cryptocurrency exchange Cryptomus has been fined CA$177 million (US$127 million) by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) for failing to report more than 1,000 suspicious transactions linked to darknet markets, distribution of child sex abuse material, fraud, ransomware, and sanctions evasion. It additionally failed to report more than 7,500 transactions originating from Iran, and more than 1,500 high-value transactions. Cryptomus was temporarily banned from trading in British Columbia in May. The CA$177 million fine smashes Canada's previous record for the largest penalty they've ever imposed. That honor previously went to KuCoin, another crypto exchange fined CA$20 million (US$14.3 million) in September.
October 28, 2025 at 6:08 PM
web3isgoinggreat.com
Fortress Trust is insolvent

October 22, 2025
https://www.web3isgoinggreat.com/?id=fortress-trust-insolvency
Fortress Trust is insolvent Nevada's Financial Institutions Division has issued a cease and desist order against Fortress Trust, stating that the firm is "on the verge of insolvency". The company admits it "failed to safeguard assets under its custody and is unable to meet all customer withdrawals". The company has only around $1.3 million in actual assets in custody, while it owes customers around $12.3 million. In 2023, Fortress experienced a $15 million theft. Though the company originally announced it would be acquired by Ripple, which had agreed to cover the shortfall, the deal eventually fell through. It's not clear how — or if — the funds were ever restored. Fortress's insolvency has strong parallels to that of Prime Trust, another trust company that shares a founder in Scott Purcell. NFID issued a cease and desist to Prime Trust in June 2023 after finding the company was insolvent; in bankruptcy proceedings, that company later blamed much of the insolvency on losing access to a
October 27, 2025 at 11:59 PM
web3isgoinggreat.com
Paxos accidentally mints more than twice the global GDP in PayPal stablecoins

October 15, 2025
https://www.web3isgoinggreat.com/?id=paxos-accidental-mint
Paxos accidentally mints more than twice the global GDP in PayPal stablecoins Paxos, the issuer of PayPal's PYUSD stablecoin, accidentally minted 300 trillion of the supposedly dollar-pegged token. For context, this is approximately 2.5x the global GDP, and around 125x the total number of US dollars actually in circulation. Paxos later announced that the mint was an "internal technical error", and that they had burned the excess tokens. While PayPal promises its customers that "Reserves are held 100% in US dollar deposits, US treasuries and cash equivalents – meaning that customer funds are available for 1:1 redemption with Paxos," there clearly isn't much in the way of safeguards to ensure that is always the case. As with most stablecoin issuers, Paxos merely issues self-reported and unreviewed portfolio reports, and monthly third-party attestations (not audits) of reserves.
October 15, 2025 at 9:37 PM
web3isgoinggreat.com
Hyperliquid user loses $21 million to private key leak

October 10, 2025
https://www.web3isgoinggreat.com/?id=0x0cdc-theft
Hyperliquid user loses $21 million to private key leak An attacker apparently obtained access to a victim's private key, enabling them to drain $21 million in various crypto assets. The attacker quickly bridged the stolen funds to ETH, then bounced through various addresses in hopes of disguising their origin and making the funds more challenging to recover. Some originally feared that the theft was enabled by an exploit on Hyperliquid itself, shortly after another Hyperliquid-based project was compromised, but the theft appears to have been a key leak rather than an exploit on the protocol.
October 14, 2025 at 11:30 PM
web3isgoinggreat.com
Reddit shuts down its NFT avatars project

August 28, 2025
https://www.web3isgoinggreat.com/?id=reddit-shuts-down-nft-avatars
Reddit shuts down its NFT avatars project Three years after launching "Collectible Avatars", the NFT project they didn't want to call "NFTs" because they were already becoming kind of cringe, Reddit has decided to pull the plug. "Well, this is one of those posts. The kind that we hoped we would never have to write," they wrote. Reddit has ended submissions for new avatars, and will shut down its avatar shop, collection display on profiles, and NFT wallet feature. The feature is apparently so unused that the shutdown announcement garnered zero comments in the r/CollectibleAvatars subreddit. Besides posts relating to the shutdown, the most recent post in the subreddit was a year old. This is the second blockchain-based feature Reddit has sunset, following the October 2023 decision to end their "Community Points" feature.
October 14, 2025 at 10:52 PM
web3isgoinggreat.com
Abracadabra loses more "Magic Internet Money" to third hack in two years

October 4, 2025
https://www.web3isgoinggreat.com/?id=abracadabra-exploit-3
Abracadabra loses more "Magic Internet Money" to third hack in two years In their third major hack in two years, the Abracadabra defi lending project lost $1.8 million of their Magic Internet Money stablecoin. An attacker took advantage of a bug in the project smart contracts to borrow more than their provided collateral would normally allow. The attack was funded via Tornado Cash, and the exploiter then swapped the stolen tokens for ETH and laundered them back through Tornado. The project disclosed the theft, describing the exploit as affecting "some deprecated contracts". They downplayed the theft, saying they'd bought back the stolen assets using treasury funds. Abracadabra previously suffered a $13 million theft in March 2025, and a $6.5 million theft in January 2024.
October 6, 2025 at 1:53 PM
web3isgoinggreat.com
SBI Crypto likely suffers $21 million theft

September 24, 2025
https://www.web3isgoinggreat.com/?id=sbi-crypto-theft
SBI Crypto likely suffers $21 million theft Crypto sleuth zachxbt observed $21 million in "suspicious outflows" from SBI Crypto, a crypto mining subsidiary of the Japanese SBI Group. The money was quickly laundered through instant exchanges and Tornado Cash, in ways zachxbt observed were similar to tactics of North Korean crypto thieves. SBI Crypto has not made any public statements addressing the apparent theft.
October 2, 2025 at 4:36 PM
web3isgoinggreat.com
Griffin AI exploited for $3 million one day after launch

September 24, 2025
https://www.web3isgoinggreat.com/?id=griffin-ai-exploit
Griffin AI exploited for $3 million one day after launch One day after Griffin AI launched its GAIN token on Binance Alpha, an attacker minted 5 billion fake GAIN tokens on the Ethereum blockchain, then exploited a cross-chain endpoint to trick the bridge to the Binance chain into recognizing them as the real thing. The attacker was only able to sell a small fraction of their tokens, but they made off with approximately $3 million as the token plunged in price. According to CEO Oliver Feldmeier, the exploit was enabled by "a misconfigured layer Zero (cross-chain messaging) set-up and compromised key". Griffin AI promises to allow customers to "build, deploy, and scale autonomous AI agents for crypto finance". These are essentially AI-powered bots that perform various functions — some of Griffin's advertised examples include a "robo-adviser" to provide "tailored investment strategies", and bots to do arbitrage trading or manage staked assets.
September 30, 2025 at 8:53 PM
web3isgoinggreat.com
Futureverse announces restructuring two years after raising $54 million

September 29, 2025
https://www.web3isgoinggreat.com/?id=futureverse-announces-restructuring
Futureverse announces restructuring two years after raising $54 million In 2023, there was no shortage of buzzy press coverage for Futureverse, which promised to build a metaverse and gaming-focused blockchain. They partnered with Ready Player One author Ernest Cline to build the "Readyverse". They partnered with the estate of Muhammad Ali to build an "AI-powered" boxing game (with NFTs!) They partnered with Rebook to build a "virtual sneaker design experience", where customers could design sneakers to equip to their Fortnite or Roblox characters. That year, the company had raised $54 million in a Series A round led by 10T Holdings and Ripple Labs. They made even more money from token sales to retail investors. As recently as this year, Futureverse was earning spots on "most innovative company" lists. In April, they announced they'd be acquiring Candy Digital, an NFT company created by Mike Novogratz, Gary Vaynerchuk, and others (which itself had raised a $100 million series A in 2021 But now, Futureverse has announced they've "made the difficult decision to begin a restructuring of the business". Focusing only on the AI portion of their business, and conspicuously omitting any mention of blockchains, NFTs, or metaverses, the company says they "recognize that adjustments are needed to ensure the long-term sustainability of our vision." Futureverse locked comments on the post, likely to try to dodge angry community members who accused the company of stealing from them or rug-pulling.
September 30, 2025 at 8:17 PM
web3isgoinggreat.com
Hypervault rug pulls for $3.6 million

September 26, 2025
https://www.web3isgoinggreat.com/?id=hypervault-rug-pull
Hypervault rug pulls for $3.6 million Only days after the Hypervault yield farming platform announced on Twitter that they'd surpassed $5 million in total value locked, the platform suddenly shut down its website and social media accounts. Simultaneously, the crypto security firm PeckShield observed an "abnormal withdrawal" of a large quantity of various crypto assets priced at around $3.6 million, which were swapped to 752 ETH (~$3.1 million) and laundered through Tornado Cash. The project had attracted customers by advertising yields of 76–95%.
September 30, 2025 at 7:45 PM
web3isgoinggreat.com
Seedify launchpad project suffers bridge exploit

September 23, 2025
https://www.web3isgoinggreat.com/?id=seedify-bridge-exploit
Seedify launchpad project suffers bridge exploit An attacker exploited bridges for SFUND, the token issued by the Seedify launchpad and incubator. It appears the exploiter has profited around $1.7 million from the theft. Seedify issued a statement announcing the theft, and said the bridge contracts that were exploited had been deployed for three years. The SFUND token crashed in price by around 80% before recovering somewhat. Seedify has been a launchpad for blockchain games, NFT projects, and other web3 products. The team has recently has embraced "vibe coding" — a practice in which people rely heavily on AI to generate code.
September 23, 2025 at 4:19 PM